Friday, March 29, 2024

Hackers Using Formjacking Technique to Steal Credit Card Details from Payment Forms

A new Formjacking attack campaign targets leading shopping sites and steals customers payment cards and other information from checkout pages of e-commerce sites.

Attackers inject malicious Javascript with formjacking script and those scripts steal payment information entered by users on the checkout pages and send to a typo-squatted Google analytics domain.

Security researchers from Symantec identified 30 such popular websites from different countries affected with the campaign that includes fashion stores, educational websites, websites selling sports gear etc.

Also, the inject the scripts contains codes to check for the presence of debugging tools to prevent the security researchers in analyzing the scripts.

Formjacking

The malicious scripts use to extract the URL’s loaded in the browser and determines the page visitor is in and applies a hook on the browser and collects all the information the user entered and sends to the server controlled by attackers.

“We have seen a major uptick in formjacking attacks against high-profile websites across the globe. The locally popular websites in U.S., Japan, Germany, and Australia, among other countries are injected with formjacking scripts.”

The campaign appears to be active up to at least November 25, 2018, now Symantec notifying the issues to vendors and working in resolving the same.

As a user it is not possible to identify that you are a victim of formjacking, researchers website owners monitoring of all activity on a system and block all the suspicious actions.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Top 10 Best Ways To Secure Your Computer from Cyber Attacks

Most Difficult Security Challenges for CxO (Chief x Officers) During the Cyber Attack

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles